| 标题 | RaspAP RaspAP Web GUI 3.0.9 latest version Code Injection Leading to Remote Code Execution (RCE) in RaspAP |
|---|
| 描述 | ## **Vulnerability Overview:**
- **Vulnerability Name:** Code Injection
- **Affected Software:** RaspAP-WebGUI
- **Vulnerability Location:** **`includes/provider.php`** (Line 53)
- **Severity:** Critical
## **2. Description:**
The RaspAP-WebGUI application is vulnerable to code injection due to improper handling of user-controlled input in the **`$_POST['country']`** parameter. The vulnerable code snippet can be found in the **`provider.php`** file.
**3. Vulnerable Code:**
```php
phpCopy code
if (isset($_POST['SaveProviderSettings'])) {
if (isset($_POST['country'])) {
$country = escapeshellarg(trim($_POST['country']));
if (strlen($country) == 0) {
$status->addMessage('Select a country from the server location list', 'danger');
} else {
$return = saveProviderConfig($status, $binPath, $country, $id);
}
}
}
```
- **Vulnerability Name:** Code Injection
- **Affected Software:** RaspAP-WebGUI
- **Vulnerability Location:** **`includes/provider.php`** (Line 53)
- **Severity:** High
**2. Description:**
The RaspAP-WebGUI application is vulnerable to code injection due to improper handling of user-controlled input in the **`$_POST['country']`** parameter. The vulnerable code snippet can be found in the **`provider.php`** file.
**3. Vulnerable Code:**
```php
phpCopy code
if (isset($_POST['SaveProviderSettings'])) {
if (isset($_POST['country'])) {
$country = escapeshellarg(trim($_POST['country']));
if (strlen($country) == 0) {
$status->addMessage('Select a country from the server location list', 'danger');
} else {
$return = saveProviderConfig($status, $binPath, $country, $id);
}
}
}
```
### **Impact:**
- Remote code execution (RCE) on the server.
- Unauthorized access to sensitive data.
- Compromise of system security.
- Potential disruption of service availability. |
|---|
| 来源 | ⚠️ https://toradah.notion.site/Code-Injection-Leading-to-Remote-Code-Execution-RCE-in-RaspAP-Web-GUI-d321e1a416694520bec7099253c65060?pvs=4 |
|---|
| 用户 | torada (UID 61170) |
|---|
| 提交 | 2024-03-06 20時22分 (3 年前) |
|---|
| 管理 | 2024-03-15 12時50分 (9 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 256919 [RaspAP raspap-webgui 3.0.9 HTTP POST Request includes/provider.php country 权限提升] |
|---|
| 积分 | 17 |
|---|